Note: There have been reported issues of some people have increased trouble with their systems when trying the process outlined here on 10.6 Snow Leopard. Proceed at your own Risk if you are running 10.6. This has successfully worked with 10.5
A couple of weeks ago I was testing out some software updates on my shiny new Mac Pro. After I was finished testing things out I noticed that the Mac was slow, very slow. I fired up the Activity Monitor to see what was going on. Turns out a background process called syslogd was running up the CPUs. Syslogd is the Apple System Log Server. It gathers logging statements from all the various running applications and saves them in case you need to look at them later. If you open the Console Applications from the /Applications/Utilities folder, you can read the logs created by syslogd.
What I couldn’t figure out was why syslogd was using an enormous amount of the Mac Pro’s resources. A little Googling revealed that syslogd stores the most recent log statements in a database file so they can be searched quickly. This database file has the property of fast access for reading, but it is slow to update with new entries. In fact, if an application logs too much information in a certain amount of time syslogd can no longer update the database file in a reasonable amount of time and it begins taking up more and more resources. Most people noticed this problem when using time machine as time machine does log changes to your file system (which can add up). The software I was testing was sending more log statements than syslogd could handle.
Now that I’ve found what was going on, I still had to do something about it. Syslogd can accept additional start up information that controls what kind of log messages it will accept, how often the database file will be purged of old log messages, and other options. These settings are located in a file in the System Folder of your Mac. If you’re feeling lucky (or geeky), you can edit this file directly. However, I recommend Lingon, a free app that does all the heavy lifting for you.
Once you’ve downloaded and installed Lingon, you can start it up and it looks something like this:
On the left hand nav menu, there is an item that says System Daemons, go ahead and expand that item and then scroll down the listings until you find com.apple.syslogd. Once you click on the com.apple.syslogd item you will be presented with a warning that looks like this:
Go ahead and click OK. You are then presented with the syslogd startup information, such as it’s name, the path to the application (i.e. /usr/sbin/syslogd) and other startup information. You can add startup parameters to the application as command line arguments. I changed /usr/sbin/syslogd to /usr/sbin/syslogd -c 3 -a and then saved the file. You will need administrator rights in order to save the changes. Once you are done, it should look something like this in the “What” field:
The -c 3 tells syslog to ignore less important messages. There are 8 log levels with 0 being the highest (or most important) and 8 being the lowest. With -c 3, syslogd will only log messages with a log level of 3 or less. The -a parameter tells syslog to archive the database, clearing out entries over 24 hours old.
I haven’t had any syslogd problems since I’ve added these new options. However, with Lingon I can go back and adjust if I need to. So if your Mac slows down, it’s probably not spyware or anything like that, just a little logging application with a hungry appetite for CPU cycles. Lingon lets you tell syslog, “you on a diet.”
